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REMARKS 

Double Patenting 

Enclosed is a terminal disclaimer in compliance with 37 CFR 1 .321(c) or 1 .321(d) to the 
rejection based on a non-statutory double patenting ground of rejection. 

35U.S.CS 103 

The examiner rejected claims 1-5, and 14-16 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Malan et al. (U.S. 20020032871) in view of Cidon et al. (U.S. Patent No. 
6,269,330). 

Applicant disagrees that Malan whether taken alone or in combination with Cidon 
discloses any of the features of claim 1 or the other rejected claims for the reasons of record. 
Nonetheless, in order to advance prosecution of this matter applicant has taken the allowable 
subject matter as set out below. 

Allowable Subject Matter 

However, the examiner also indicated that Claims 6-13, and 17-22 were objected to as 
being dependent upon a rejected base claim, but would be allowable if rewritten in independent 
form including all of the limitations of the base claim and any intervening claims. 

Applicant has amended claims 1 and 14 to include the features of cl aims 4 and 6 in claim 
1 and the features of claim 17 into claim 14. 

Claim 1 specifically has been amended to call for "...the aggregator device further 
comprising: a process executed on the aggregator device to detect anomalies in connection 
patterns; and a process on the aggregator device to aggregate detected anomalies into the 
network events with the anomalies that are detected including denial of service attack anomalies 
and scanning attack anomalies. 
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The features of a process executed on the aggregator device was not specifically recited 
in either claim 4 or claim 6, but Applicant believes that it could forestall a potential rejection 
under 35 U.S.C. 101. 

Applicant has amended claims 1 and 14 to make the claims more readable and has 
amended claim 16 to recite "determining from the connection information and the statistical 
information occurrences of network anomalies." That feature is fully supported by the 
Specification as filed on pages 16-27, see especially pages 16-17. 

The examiner also indicated allowed subject matter in claims 23 and 24. The examiner 

stated: 



As per claim 23, the Examiner finds the novel and non obvious feature of claim, 
when read as whole to be detecting a new host connecting to a network comprises 
receiving statistics collected from a host in the network and indicating to a console 
that the host is a new host if, during a period of time T, the host transmits at least N 
packets and receives at least N packets, and if the host had never transmitted and 
received more than N packets in any previous period of time with a duration of T. 

As per claim 24, the Examiner finds the novel and non obvious feature of claim, 
when read as whole to be detecting a failed host in a network comprises determining 
if both a mean historical rate of server response packets from a host is greater than 
M, and a ratio of a standard deviation of historical rate of server response packets 
from the host to a mean profiled rate of server response packets from the host is less 
than R over a period of time; and indicating the host as a potential failed host if 
both conditions are present. 

Applicant does not necessary disagree with these reasons for allowance but submits that 
other reasons for allowance may exist. 

Applicant has added new claims 25-27, which are fully supported in Applicant's 
specification on pages 30-32. 

The feature of claim 25 "determining the minimal rate of N/T packets/second to avoid 
false positives caused by scans or spoofing attacks. " is supported on page 3 1 , lines 3-7. 

The features of claim 26 "determining a period seconds of continuous inactivity of the 
potential failed host to expire the potential failed host after the period of continuous inactivity; 
and generating a new host event if the expired failed host sends traffic on the network a fter the 
period of continuous inactivity has elapsed." are supported on page 31, line 30 to page 32, line 2. 

The feature of claim 27 "wherein a host failure indicates an inability by the host to 
generate traffic on the network or an application failure." is supported on page 32, lines 3-5. 
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Please charge the Petition for Extension of Time fee of $60 and please apply any other 
charges or credits to deposit account 06-1050. 



Fish & Richardson P.C. 
225 Franklin Street 
Boston, MA 021 10 
Telephone: (617)542-5070 
Facsimile: (617) 542-8906 




Respectfully submitted, 



Reg. No. 29,670, 
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